Sandboxing
Sandboxing is the isolation of software execution in a restricted environment that limits its access to resources and its effects on surrounding systems.
Refactoring to Rust
A sandboxed environment is an isolated execution environment that restricts a program's access to resources outside explicitly permitted interfaces.
- How it is used
- Limits what replaceable Wasm modules can access when a host application executes them.
- How deep it goes
- Explains the isolation boundary and walks through module-memory exchange, while leaving broader VM design as a host responsibility.
- Examples
- Uses a Rust allocation function and host-driven book and paper searches to illustrate memory exchange.
- What you can do after
- Operate/configure a WASI-enabled host to pass data through an isolated Wasm module’s memory.
Build an AI Agent (From Scratch)
A sandbox environment is an isolated execution environment that restricts code or tool operations from affecting the surrounding system.
- How it is used
- Isolates agent-generated code so agents can execute flexible workflows without running that code directly on the host.
- How deep it goes
- Works through E2B creation, execution results, state, timeouts, and cleanup; contrasts managed sandboxes with configuring Docker isolation directly.
- Examples
- Uses an E2B calculation, Wikipedia reference counting across 31 pages, and spreadsheet analysis with pandas.
- What you can do after
- Build it from scratch with E2B to run agent code, inspect failures, retain session state, and contain host-side risks.
Read how Build an AI Agent (From Scratch) explains sandboxing →
Server-Side WebAssembly
Sandboxing is a security technique that confines code to a restricted execution environment and limits its access to host resources.
- How it is used
- Uses restricted execution to isolate Wasm components, protect cloud applications, and safely run application plugins.
- How deep it goes
- Explains memory-safe isolation, capability-controlled OS access, and supply-chain benefits, while stopping short of implementation commands or runtime configuration.
- Examples
- Uses controlled standard output, isolated cloud components, application plugins, and comparisons with containers and virtual machines.
- What you can do after
- Evaluate Wasm as an isolation mechanism for plugins and cloud components while recognizing multithreading and ecosystem limitations.
Related concepts
- execution environmentkind of · An execution environment is the computing context, including hardware, software, configuration, and supporting resources, in which programs run.
- browserimplemented by · A web browser is software that retrieves, interprets, and renders web resources, executes supported web content, and enables interaction with web pages and applications.
- blast radiusaddresses · Blast radius is the scope of systems, components, data, users, or functionality that may be affected by a failure, change, or other disruptive event.
- Claude Codeused by · Claude Code is Anthropic’s command-line AI coding agent for inspecting and modifying software projects and performing development tasks through natural-language instructions and tools.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.